Skip Auto DevOps DAST when REVIEW_DISABLED is set

doc/topics/autodevops/stages.md

@@ -241,6 +241,8 @@ You can disable DAST:
 - On all branches by setting the `DAST_DISABLED` environment variable to `"true"`.
 - Only on the default branch by setting the `DAST_DISABLED_FOR_DEFAULT_BRANCH`
   environment variable to `"true"`.
+- Only on feature branches by setting `REVIEW_DISABLED` environment variable to
+  `"true"`. This also disables the Review App.
 
 ## Auto Browser Performance Testing **(PREMIUM)**
 

lib/gitlab/ci/templates/Security/DAST.gitlab-ci.yml

@@ -36,3 +36,4 @@ dast:
     variables:
       - $DAST_DISABLED
       - $DAST_DISABLED_FOR_DEFAULT_BRANCH && $CI_DEFAULT_BRANCH == $CI_COMMIT_REF_NAME
+      - $CI_DEFAULT_BRANCH != $CI_COMMIT_REF_NAME && $REVIEW_DISABLED && $DAST_WEBSITE == null && $DAST_API_SPECIFICATION == null